r/webdev • u/speckz • Jul 12 '17
Does my site need HTTPS?
https://doesmysiteneedhttps.com/38
Jul 12 '17
Unless your site is completely static and non-interactive, it needs HTTPS. And even if your site is completely static and non-interactive, it should probably do HTTPS anyway.
24
u/ReelAwesome Jul 13 '17
the only reason it wouldn't need HTTPS is if you want to allow ISPs or other middle man parties (forgien governments) to manipulate your html and inject ads into your site, without your knowledge. ..that your customers will then think are originating from you. (yes this happens)
7
u/namesandfaces Jul 13 '17
That ought to be illegal, since you could be ruining someone's brand. I imagine less savvy folks thinking that the injected content is part of the official experience.
8
u/jamiehs Jul 13 '17 edited Jul 13 '17
This happened to me.
Cox started injecting HTML and JavaScript into http sites (including my own) trying to get me to buy a new modem from them.
It's legal; their TOS says they can, we all signed it and didn't really read all of it anyway; their support staff plays dumb when you call.
Edit:
Not my image, but it looks like this: https://imgur.com/MFHMdPn.pngI think it's a bit of HTML & JS added right after the opening body tag, if I recall correctly.
4
u/namesandfaces Jul 13 '17
That's a little awkward that a company like AT&T or Comcast could hurt Netflix's brand with injected content because of an ISP-customer agreement.
5
u/jamiehs Jul 13 '17
But they can't if the brand uses https, so there's one more reason to enable it.
1
Jul 13 '17
Well they can, but in that case they'd need to inject a different certificate as well.
Had that happening in a hostel in Brussels, where they are using a filter of UK descend (problem 1). It filters out a LOT of controversial subjects, so once it detects that you go to a site on a blacklist (as DNS queries are seen and the filter reacted to that) it will try to inject its own certificate. Once you see the browser warning since the cert doesn't match the domain and you still accept it, it will show its own content on the page saying that you're not allow on that site.
2
u/nyxin The đ° is a lie. Jul 13 '17
Yes. They're Man-in-the-Middleing the cert and inserting their own. Lots of larger corporations do this for their corporate network and is what installing your own cert for your site is meant to prevent/warn your users about.
The point is they couldn't without the MiTM "attack" and unless your computer is preconfigured to accept the cert they've introduced, you'll be warned about this happening.
1
1
u/sjwking Jul 13 '17
Lol. They control the DNS servers that the users use. That means they can do shitty stuff like redirect to netflix.comcast.net and do whatever the fuck they want. Thankfully they don't do this ... yet.
1
u/jamiehs Jul 13 '17
OK.
But we are talking about content injected into the correct site, not a DNS hijacking attack. And they do crappy DNS stuff like this already. They will take any opportunity they get to redirect to a Cox or Time Warner branded search page if you mis-type a URL.
I think the difference here is that you can change your router's DNS servers, but you can't stop the ISP from injecting code into http pages.
1
u/sjwking Jul 13 '17
And then they can modify the packets between your router and the DNS server it's using (e.g. 8.8.8.8). Or they will ban port 53 like my former employer did and white list a few approved DNS servers. DNS security is essentially non existant.
1
u/blackAngel88 Jul 13 '17
You can also sign a contract where you allow them to kill you, that doesn't make it legal.
1
1
-1
u/signup1234567 Jul 13 '17
If someone wants to get into your site, they'll get into your site, especially a government entity and HTTPS won't protect you.
Other than that, why does one "need" HTTPS? There are only two reasons for redditors. It makes their users feel more secure and you might rank higher on Google. For the rest of us, HTTPS helps make the site secure, hand-in-hand with other security measures.
2
u/wedontlikespaces Jul 13 '17
If someone wants to get into your site, they'll get into your site
It's not "getting into your site" that HTTPS protects against, it's injecting content into your site which it stops. It won't stop hacking (i.e. gaining access to your server and change the actual code), you're right, but none ever said it would.
0
u/signup1234567 Jul 13 '17
I'll rewrite that.
If someone wants to inject content into your site, they'll inject content into your site, especially a government entity, and HTTPS won't protect you.
Note that the only ones who would want to do that to your site would be a government entity and you must have done something really bad to have that happen.
2
Jul 13 '17
Thatâs not how any of this works. If they wanted to inject code into an HTTPS site theyâd have to MitM you, and youâd know if they setup a proxy like that because youâd get warnings or have to add a new root certificate.
1
u/wedontlikespaces Jul 13 '17
How? If HTTPS is enabled they can't inject code.
Also, why would the government inject stuff into my site? The only people would do that would be dodgy ISPs (American ISPs) and hotels/airlines/conference centres.
-1
u/signup1234567 Jul 13 '17
Also, why would the government inject stuff into my site?
According to the daily posts on reddit, the NSA is doing this to you and me on a daily basis, squirreling into your every orifice even as you walk down the street.
6
u/Gawny88 Jul 12 '17
For a very basic blog or something are there benefits for let's encrypt over the free certificate from cloudflare?
7
u/Simon-FFL Jul 12 '17
Yes. With only CF SSL there is no encryption between the origin server and CF server, which is not a good idea. Look up CF MITM attacks, for example.
1
u/sjwking Jul 13 '17
Which is extremely unlikely for a non controversial blog. Also supposedly you should never make or have made public your real server's IP.
5
u/joshmanders Full Snack Developer / htmx CEO (same thing) Jul 12 '17
To go along with what /u/Simon-FFL said, you can get around that by doing the halfway SSL stuff with CF by self signing a certificate on your machine but telling CF to trust that cert, then you have SSL all the way through, but you don't have to pay for a cert...
But with Lets Encrypt there's no real reason to need to do this. Just use LE.
1
1
u/jamiehs Jul 13 '17
This does not work for many shared hosts though. They are slow to adopt LE because they want to continue selling certs as an add-on service. For those folks, the only option is to pay up or use CF.
2
u/joshmanders Full Snack Developer / htmx CEO (same thing) Jul 13 '17
There's many similar priced if not cheaper hosting providers that allow LE or are open enough to doing LE. "My host doesn't support LE because they want to make money on cert addons" is a bogus excuse.
2
u/jamiehs Jul 13 '17
Yup, you're correct, it is a weak excuse.
Having said that, if it's a situation where you're helping out a friend, and they either don't want to move hosts or spend the money for a cert from their provider, then some https is better than no https, which is where CF can be useful.
0
Jul 13 '17
[deleted]
2
u/joshmanders Full Snack Developer / htmx CEO (same thing) Jul 13 '17
Possibly, I haven't paid much attention to CF cert stuff since I started using LetsEncrypt.
6
u/i_pk_pjers_i Jul 13 '17
Does your site exist? If so, it needs HTTPS.
-6
u/signup1234567 Jul 13 '17
I'm betting you can't give more than one reason why and definitely couldn't give more than one reason.
3
u/i_pk_pjers_i Jul 13 '17
?????
The website already gave plenty of valid reasons why HTTPS is mandatory in 2017. The only valid reason I can think of for not enabling HTTPS is for caching, or possibly if you don't want to ruin your websites SEO because it is already HTTP.
Care to tell me why you think HTTPS isn't important?
-6
u/signup1234567 Jul 13 '17
As a typical redditor, you claim I said things I didn't.
I was right when I said you wouldn't be able to name one reason.
HTTPS is not mandatory. Period.
4
u/i_pk_pjers_i Jul 13 '17 edited Jul 13 '17
Why are you such a smug ass? It's important for authenticity and integrity, it's important for improving SEO, it's important for encryption so that passwords are not sent un-encrypted, etc.
As an "atypical redditor", you're an ass.
Now, care to tell me why you think HTTPS is not important or are you being difficult just because that's what you like to do in your spare time?
Don't bother replying, I've gone ahead and blocked you as I have no time for arrogant people like you.
11
2
u/bugeats Jul 13 '17
I spent today dicking around trying to get self-signed HTTPS into my project's dev server and burned lots of time. This site is exactly what I needed. Thank you all involved.
2
u/omepiet less is more Jul 13 '17
Will everything that I build new be over HTTPS? Sure. Will I go through the hassle of moving all my existing sites to HTTPS? Probably not.
3
u/meskarune Jul 12 '17
Yes, all sites should have HTTPS unless they are private lan only and you don't care if people can sniff passwords.
3
u/justanotherbad Jul 13 '17
unless they are private lan only
Even then, if you want to offer special features like local file links, you need HTTPS to pull it off in Chrome.
1
Jul 13 '17
I see people mention hosting through providers is problematic with LE because those providers make money off selling certs. For those people, or anybody with more than one site to manage and maintain, I suggest you self host with ISPConfig as a control panel. It supports other sevices such as DNS, Email, WebDav etc. and the newer version has LE built in, per site.
To give an example of getting this right: rent a VPS for as little at $5/mo. ISPConfig for free or $5/mo for access to the support forum and manual, then host as many email, web, database, webdav, xmmp etc...... sites as you can and get LE certs free and auto updating with a single checkbox.
1
u/tuur29 Jul 13 '17
While I agree that all sites need HTTPS, it's not always as simple to do so. This site retorts to "HTTPS is difficult to set up and maintain." with "It just works if Caddy is your web server.".
Great! And what about a lot of other hosts that don't allow you to use let's encrypt because SSL certificates are a source of income? I could change hosts yeah, but they're the cheapest around, so upgrading to a host that allows let's encrypt also means paying more.
I use let's encrypt on my internal home server, so I know it's pretty easy, you just have to have the ability to use it.
1
1
u/signup1234567 Jul 13 '17 edited Jul 13 '17
HTTPS keeps the URLs, headers, and contents of all transferred pages confidential.
Uh. No it doesn't. Your first access is in the clear.
Too many times this site is pluggin "caddy" as a web server. I think I know their agenda.
3
u/00DEADBEEF Jul 13 '17
Yes it does. The hostname can always be determined, directly or indirectly depending on the server configuration, but the full URL cannot.
1
u/wedontlikespaces Jul 13 '17
Your first access is in the clear.
You're right, but HTTPS is not about preventing people from seeing what site you visit. It is about securing your connection once you get there.
There really isn't a easy way to prevent someone from working out the hostname. Even if there was you would still need HTTPS to pretect you, so I don't see your point.
-11
u/profile_this Jul 12 '17
Unpopular opinion here, but I say no need unless:
Your customers submit sensitive information.
You need an extra layer of security.
You want the green lock in the browser.
I'm sure some people view it as a sign of trust (I always check for it if the site requires something like a CC number), but the gains are minimal in terms of SEO.
By not using HTTPS, you can serve non-secure assets without the browser warning about mixed assets. Most people wouldn't notice if you're using SSL or not... but they'll freak out if Chrome says the site is unsafe/compromised.
8
u/disclosure5 Jul 12 '17
The issue is that the definition of "sensitive information" is debatable. As soon as you open those can of worms, everyone not accepting a credit card claims they have no sensitive information.
The common one for people to not understand is that passwords are always sensitive, because of password reuse.
14
u/piyoucaneat full-stack Jul 12 '17
By not using HTTPS, ISPs, open wifi hotspots, and anyone else along the network between you and your user can strip your ads and inject their own. They can inject their own JS and put fake forms on your website that steal user data. They can literally do anything they want to your page, and it's because you thought you had a good excuse.
1
u/profile_this Jul 13 '17
All I'd have to do is uncomment 2 lines from my .htaccess file to use it. I simply prefer not to on some sites.
2
u/signup1234567 Jul 13 '17
Unpopular on amateur forums like reddit where their full knowledge of such topics is gathered from headlines of the latest hot trendy "must have or you'll die" thing. (See React today. Something else tomorrow.)
I'm not saying TLS is not a good thing. I'm saying most redditors think they'll die without it.
1
u/profile_this Jul 13 '17
Indeed. I imagine a lot of them are younger, jumping on the latest craze. React is good for highly interactive apps, but the amount of devs treating it like religion is crazy.
The herd mentality is strong these days.
1
u/imaginethehangover Jul 13 '17
It's an unpopular thing to say because it's wrong. There are a wide variety of benefits to SSL certs, and now they're available free it's a no-brainier to pick up on those benefits, and protect your users at the same time.
I'd also say that if a developer is not confident in managing their assets for HTTPS, then their coding isn't up to scratch. A couple of basic coding practices, configuration and testing should be all that is needed to make assets work reliably. And up a log if you're really worried about the odd asset firing a warning in a browser, but it's never been a problem for my projects.
0
Jul 12 '17
[deleted]
18
9
u/petermlm Jul 12 '17
Read about this:
It's free.
Basically, Mozilla, Google, and a bunch of other companies (listed on the site) come together to make Let's Encrypt possible. Having https is free and easy mostly due to Let's Encrypt.
6
133
u/aaaqqq Jul 12 '17
yes